CVE-2023-46245

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

• CWE-1336

• https://github.com/kimai/kimai/commit/38e37f1c2e91e1acb221ec5c13f11b735bd50ae4
• https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcwExploit, Vendor Advisory
• https://github.com/kimai/kimai/commit/38e37f1c2e91e1acb221ec5c13f11b735bd50ae4
• https://github.com/kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcwExploit, Vendor Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4624Server-Side Request Forgery (SSRF) in GitHub repository book…2.4
• CVE-2023-46240CodeIgniter is a PHP full-stack web framework. Prior to Code…7.5
• CVE-2023-46241`discourse-microsoft-auth` is a plugin that enables authenti…8.1
• CVE-2023-46242XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46243XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46244XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46246Vim is an improved version of the good old UNIX editor Vi. H…5.5
• CVE-2023-46247Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-46249authentik is an open-source Identity Provider. Prior to vers…9.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5